SnoGE

Take your Snort or Sourcefire IPS events and place them onto Google Earth

Updates

Version 1.8. Supports Unified2 format logs (make sure you upgrade your copy of snort-unified-perl!)

FAQ

Q Where can I post problems and get help?

A Please use the googlecode issue tracking system for now: http://code.google.com/p/snoge/issues/list

Q I'm trying to read unified2 files, and SnoGE says they're not supported

A Make sure you're using version 1.8

Q What version of snort-unified-perl do I need to use?

A Depends on the version of SnoGE you're using. Old (versions 1.7 and earlier) require SnortUnified_Perl.20070927.tgz. Version 1.8 and above need SnortUnified_Perl.20100308.tgz

Q Where can I find good documentation?

A No idea, I'm looking for someone to write some for me. I have blogged about SnoGE a few times, and there is some basic info here http://code.google.com/p/snoge/wiki/Install